CVE-2022-42787

Published Nov 10, 2022

Last updated 2 years ago

Overview

Description
Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.
Source
info@cert.vde.com
NVD status
Analyzed

Risk scores

CVSS 3.1

Type
Primary
Base score
8.8
Impact score
5.9
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

info@cert.vde.com
CWE-330
nvd@nist.gov
CWE-330

Social media

Hype score
Not currently trending

Configurations